Re: iptables-restore

green wrote at 2010-06-20 12:54 -0600:
> Huang, Tao wrote at 2010-06-20 09:42 -0600:
> > On Sun, Jun 20, 2010 at 10:07 PM, green <[email protected]> wrote:
> > > However, iptables scripts usually begin with a flush, and then it takes time to
> > > add all those rules, plus some possible interruption to traffic meanwhile.
> > > What about if only a small change has been made?  Does iptables-restore flush
> > > first, or is it able to just change the rule set as necessary to match?  (And
> > > is there a term used to describe that feature?)
> > 
> > in the man page of iptables-restore:
> > 
> > -n, --noflush
> 
> Ah yes, I missed that.  So iptables-restore does not include intelligent 
> modification of rules.

Hmm, maybe iptables-restore is what I want after all:
http://lists.debian.org/debian-user/2007/03/msg03772.html

And I think this answers my question:
http://www.faqs.org/docs/iptables/saveandrestore.html

So iptables-restore should work much faster than separate iptables commands in 
a script.  I will attempt to write a script that builds an iptables-save file 
and inserts the entire rule-set in one invocation.  I could simply use a 
iptables-save file directly but I require good readability, and I don't think I 
can mix tables in the iptables-save file.

Comments welcome.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkweaA0ACgkQ682C+dBP+oQOrACgxHF4XaN1OkNePYX1xru7fTYg
g+oAnRjkdM5Q8cYz+IPFIXNd2YvX70Bv
=xA51
-----END PGP SIGNATURE-----